After ISO/USB images are generated from the secureboot directories,
move autoexec.ipxe to the ipxe root as a standalone file and remove
the secureboot directories. This means:
- Checksums are generated cleanly with no secureboot-* subdirectory entries
- autoexec.ipxe is checksummed automatically as a regular ipxe/ file
- build_release needs no special handling for secureboot directories
- autoexec.ipxe flows naturally into both githubout (release asset)
and s3out (CDN) through the existing copy logic
The Ansible-generated checksums file references files under
secureboot-x86_64/ and secureboot-arm64/ which are removed from
githubout. Strip those entries and add the standalone autoexec.ipxe
so the checksums file matches the actual release assets.
Ensure autoexec.ipxe is available at the root of the S3 bucket
(boot.netboot.xyz/{version}/autoexec.ipxe) alongside other boot
files, not only nested under ipxe/secureboot-x86_64/.
Instead of repackaging the iPXE signed binaries into netboot.xyz
tarballs, publish only the templated autoexec.ipxe boot script as a
release asset. Consumers (e.g. docker-netbootxyz) download the signed
binaries directly from the upstream iPXE release (ipxeboot.tar.gz),
preserving provenance and avoiding checksum mismatches from
repackaging.
The autoexec.ipxe is identical for both x86_64 and ARM64 -- it
contains the netboot.xyz-specific boot_domain, boot_version, and
menu chain logic with DHCP, failsafe menu, and HTTPS/HTTP fallback.
The Secure Boot directories (secureboot-x86_64/, secureboot-arm64/)
produced by generate_disks_secureboot cannot be uploaded directly as
GitHub release assets since releases are flat file lists. Package them
into secureboot-x86_64.tar.gz and secureboot-arm64.tar.gz so they are
included in the release alongside existing boot files.
This enables docker-netbootxyz and other consumers to download the
signed iPXE Secure Boot binaries and autoexec.ipxe directly from
netboot.xyz releases.
- Update version.txt from 2.0.90 to 3.0.0
- Update boot_version from 2.x to 3.x in defaults/main.yml
- Update hardcoded version references in script/build_release
- Update example in user_overrides.yml
- Add 3.0.0 changelog entry with breaking change notice
- Users with 2.x bootloaders will auto-upgrade to 3.x on boot
IMPORTANT: Updated binaries should be downloaded to pull latest
netboot.xyz with updated code signing certificates embedded for
image signature verification.
2.x is designated as a rolling release but usually is aligned
with an actual release. This commit will allow for updates
to endpoints.yml and the Ansible defaults that contains all
of the version updates to be pushed to boot.netboot.xyz
automatically as they are come in.
This will allow version updates like ArchLinux to be rolled out
immediately with out the lag during releases.
With the recent changes to Travis CI, it seemed
like a good time to begin porting netboot.xyz CI
over to Github Actions to keep everything in on
place. These are the changes for the main
netboot.xyz repo.
* Shifting after_deploy messages and aws invalidation to
proper locations
* Add cert checkout to preinstall and setting those on s3
deploys only
* Adding production docker file which runs netboot.xyz overrides
* Only display sig menus if enabled
* Fix var names for signing
